feat(providers): native Grok runtime — opencode image, config gen, panel key

Complete the native Grok (xAI) path so grok-build-0.1 runs as a real
RoboCo agent, not just the provider seam.

- roboco-agent-grok image (docker/agent-grok.Dockerfile): FROM agent-base
  + opencode (the OpenAI-protocol runtime). One image serves every role;
  role behaviour comes from the mounted manifest / mcp-config / system
  prompt, exactly as on the Claude path.
- Entrypoint renders opencode.json at spawn from the GrokProvider env
  contract + the mounted Claude Code mcp-config.json
  (roboco.llm.providers.opencode_config): translates RoboCo's gateway
  servers (roboco-flow / roboco-do / ...) into opencode's mcp block,
  declares the xAI OpenAI-compatible provider + model, and wires
  permissions + instructions. Pure, unit-tested translation.
- Orchestrator registers GrokProvider with the registry-qualified image
  (_qualify_agent_image) so it resolves in local and registry deploys.
- Compose (both files + the registry compose) gain an agent-grok-image
  builder service.
- Panel: a Grok (xAI) API key card on the AI Providers page, plus the
  grok ModelProvider value.

KNOWN PARITY GAP (opencode runtime): the bash-guard PAT-scrub and the
transcript-based usage/cost capture are Claude Code hooks and do not
transfer to opencode. bash permission is operator-tunable
(ROBOCO_GROK_BASH_PERMISSION) so a deployment can fail closed until a
security/usage-parity opencode plugin lands. That plugin and live E2E
validation are the remaining work to finalize with xAI.

docker/agent-grok.Dockerfile

@@ -0,0 +1,32 @@
+# Grok (xAI) Agent Image
+# =============================================================================
+# Runs grok-build-0.1 through the opencode CLI (OpenAI protocol) instead of
+# Claude Code, while reusing the base image's roboco venv + uv + the RoboCo MCP
+# gateway servers. The entrypoint renders opencode.json from the spawn env +
+# mounted mcp-config.json (see roboco.llm.providers.opencode_config) and runs
+# opencode. One runtime image serves every role — role behaviour comes from the
+# mounted system prompt / manifest / mcp-config, exactly as on the Claude path.
+# =============================================================================
+
+FROM roboco-agent-base
+
+USER root
+
+# opencode — the OpenAI-protocol agent runtime. The @ai-sdk/openai-compatible
+# package backs the custom xAI provider declared in the generated opencode.json;
+# opencode also resolves it at runtime, but pre-installing keeps first spawn off
+# the network.
+RUN npm install -g opencode-ai @ai-sdk/openai-compatible \
+    && npm cache clean --force \
+    && rm -rf /root/.npm /tmp/*
+
+# Entrypoint: render opencode.json, then run opencode (overrides base's `claude`).
+COPY docker/scripts/grok-agent-entrypoint.sh /app/scripts/grok-agent-entrypoint.sh
+RUN chmod 0755 /app/scripts/grok-agent-entrypoint.sh
+
+USER agent
+
+LABEL role="grok-runtime"
+LABEL description="Grok (xAI) agent runtime — grok-build-0.1 via opencode (OpenAI protocol)"
+
+ENTRYPOINT ["/app/scripts/grok-agent-entrypoint.sh"]